Awesome

Modernisation Platform Terraform EC2 Instance

Usage

module "ec2_test_instance" {
  source = "github.com/ministryofjustice/modernisation-platform-terraform-ec2-instance"

  providers = {
    aws.core-vpc = aws.core-vpc # core-vpc-(environment) holds the networking for all accounts
  }

  for_each = try(local.ec2_test.ec2_test_instances, {})

  name = each.key

  ami_name                      = each.value.ami_name
  ami_owner                     = try(each.value.ami_owner, "core-shared-services-production")
  instance                      = merge(local.ec2_test.instance, lookup(each.value, "instance", {}))
  ebs_volumes_copy_all_from_ami = try(each.value.ebs_volumes_copy_all_from_ami, true)
  ebs_kms_key_id                = module.environment.kms_keys["ebs"].arn
  ebs_volume_config             = lookup(each.value, "ebs_volume_config", {})
  ebs_volumes                   = lookup(each.value, "ebs_volumes", {})
  ebs_volume_tags               = lookup(each.value, "ebs_volume_tags", {})
  ssm_parameters_prefix         = lookup(each.value, "ssm_parameters_prefix", "test/")
  ssm_parameters                = lookup(each.value, "ssm_parameters", null)
  route53_records               = merge(local.ec2_test.route53_records, lookup(each.value, "route53_records", {}))

  iam_resource_names_prefix = "ec2-test-instance"
  instance_profile_policies = local.ec2_common_managed_policies

  business_unit            = local.business_unit
  application_name         = local.application_name
  environment              = local.environment
  region                   = local.region
  availability_zone        = local.availability_zone_1
  subnet_id                = module.environment.subnet["private"][local.availability_zone_1].id
  tags                     = merge(local.tags, local.ec2_test.tags, try(each.value.tags, {}))
  account_ids_lookup       = local.environment_management.account_ids
  cloudwatch_metric_alarms = {}
}

For a deployed example, please check example. A second fully self-contained example has been added for ease of use.

Setting backup tags

Read the Modernisation Platform backup functionality to understand how the backup plan works. The following is a summary of the backup behaviour based on the tags that are set and passed in this module.

Production environment

By default, all production resources (EC2 and EBS) will be backed up. This is determined by the is-production tag being set to true. Production backups can be skipped by setting backup tag to false (passed in tags input).

Non-production environments

Additionally, you are able to control backups in non-production environments by setting backup tag to true (passed in tags input).

Backup duplication problem

NOTE, setting backup tag to true that is passed in tags input will set backup tag to true on all EC2 and EBS resources. This will result in duplicated backups as EBS resources that are part of an EC2 will get backed up during the EC2 backup and EBS backup selection by the backup plan.

In order to select either EC2 backups or EBS backups it is possible to set backup tag to true on only EC2 instance, by passing the tag as part of the instance.tags input or setting the backup tag to true on only EBS by setting the backup tag to true and passing it in the ebs_volume_tags input. NOTE, if the backup tag is passed in tags and instance.tags/ebs_volume_tags, the tag set on the specific resources will take priority. For example, backup tag is set to:

• true via tags input
• false via instance.tags input
• true via ebs_volume_tags input will result in:
• EC2 not being backed up
• all EBS being backed up (that includes root ebs, inline ebs and attached ebs).

Looking for issues?

If you're looking to raise an issue with this module, please create a new issue in the Modernisation Platform repository.

Requirements

Providers

Modules

No modules.

Resources

Inputs

Outputs